Static task
static1
Behavioral task
behavioral1
Sample
55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385N.exe
Resource
win10v2004-20240802-en
General
-
Target
55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385N.exe
-
Size
91KB
-
MD5
ed7ff3875118e8534c0b5ab87ebc5490
-
SHA1
9161c6ac640cb5d2458e7f45137a1279248211a8
-
SHA256
55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385
-
SHA512
6b1f9da17bc101ff653496d5bf25e7fa73c4436eb79c8e8739d81ddcaf45c2ae21191cd4223c282829d144762526b1eb4e37944142a709d13a2c1b2249eb3515
-
SSDEEP
1536:jyo44xD3rldmSMR8nKqUliDkkEPA7XnPtm6Pr1FvIKEdTzuhOChC38usHfJY6EnX:mR9HqpDtEPA7w6Pr1FvIKEdTzuhOChCH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385N.exe
Files
-
55e9425189e50f54b6431089807857163981d0e0e784796d5e21892b8065c385N.exe.exe windows:4 windows x86 arch:x86
9c4ebb38cedb02fc883c5a684eb6fef0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
CloseHandle
CopyFileA
CreatePipe
CreateProcessA
CreateSemaphoreA
CreateThread
DeleteFileA
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
GetCommandLineA
GetComputerNameA
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetTempPathA
GetVersionExA
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
ReadFile
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
lstrcpyA
lstrlenA
msvcrt
__getmainargs
__p___argc
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
_sleep
_stricmp
abort
atexit
calloc
exit
fclose
fflush
fopen
fprintf
fread
free
fwrite
malloc
memcpy
memset
printf
rand
remove
rename
signal
sprintf
srand
strcat
strchr
strcmp
strcpy
strlen
strncpy
strstr
strtok
time
user32
DefWindowProcA
DispatchMessageA
GetMessageA
MessageBoxA
PostQuitMessage
TranslateMessage
wsprintfA
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 18KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE